k8s/messaging: add kafka kmsvc and temporal workflows

- Kafka 3-broker cluster (RF=3, min-ISR=2)
- kmsvc SQS-like API on Kafka
- Redis dedup (standalone, can extend to HA)
- Temporal workflow orchestration (Cassandra backend)

k8s/temporal/temporal-ingress-oauth2.yaml

@@ -0,0 +1,27 @@
+# Ingress for Temporal UI — routes to OAuth2-Proxy, which proxies to temporal-web
+# TLS terminated here; oauth2-proxy handles OIDC auth before forwarding to backend
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: temporal
+  namespace: temporal
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: nginx
+  tls:
+  - secretName: temporal-tls
+    hosts:
+    - temporal.riotpiao.homelab.com
+  rules:
+  - host: temporal.riotpiao.homelab.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: oauth2-proxy
+            port:
+              number: 4180